> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-6.x-rn/release-information/features-introduced-in-2026/november-2026/changed-features.md).

# Changed Features

These features have been modified or removed in this release.

| FEATURE                                             | DESCRIPTION                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| --------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| API keys                                            | Previously, all users with Public API permissions could see and delete any custom API key in the tenant. Now, non-administrator users can only view and manage the keys they created, and these keys inherit the last editor's access permissions and scope.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| API key audit logging                               | Identify exactly which API key performed a logged action. Audit logs now list the API key itself, instead of showing "N/A" or the name of the user who created the key.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| Object access defaults                              | Cortex XDR now enables all granular access settings for objects by default for new tenants (located under **Settings** > **Configurations** > **Access Management**). Existing tenants remain unchanged.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Datasets                                            | Previously, any user capable of running XQL queries could create or append data to any existing user managed dataset (User, Lookup, Dataset Views, and Correlation datasets) dataset. To prevent unauthorized modifications, user managed datasets now support granular, dataset-level permissions (Create, Viewer, and Editor).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Identity association with Security cases and issues | Identity assets (UAI) are now associated with cases and issues in the Security Domain whenever possible to enhance investigation visibility. This update affects Scope-Based Access Control (SBAC), as viewing these items now requires access to the corresponding Identity assets.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| Scoped access to cases and issues                   | Access now requires either the asset or the endpoint agent in your inventory rather than both, giving teams unified visibility. Existing cases and issues keep their current visibility, except by potentially granting access to certain existing cases that contain manually merged issues with a mix of assets and endpoints.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Unified connector sub-capabilities                  | The workflow for duplicating custom integration content has changed for tenants onboarded after July 26, 2026, and for specific vendors transitioned to the unified connector experience. For sub-capabilities (integrations) within a unified connector, the **Data Sources & Integrations** page no longer offers duplication or source-code viewing - view the source code in GitHub and use the `demisto-sdk` instead. Integrations not yet transitioned keep the **Duplicate** and **View Source** options.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Unified Okta connector                              | Control exactly which Okta identity data you collect. A single Okta connector now covers log collection, asset configuration, security posture, and identity prevention.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Streamlined events list on Android                  | Keep the security events list on your Android device responsive as your event history grows. The mobile agent now stores only recent events, following a retention policy it receives from the server, and loads the list in pages.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Vulnerability feed update                           | <p>We are deploying significant backend enhancements to our vulnerability feed to deliver higher detection accuracy, reduced false positives, and richer metadata.</p><p><strong>Updates:</strong><br><strong>• Expanded Coverage (Counts May Increase)</strong>: Expanded and improved vulnerability coverage across Windows, RHEL, Amazon Linux, Rocky Linux, Debian, Oracle Linux, AlmaLinux, Alpine Linux, OpenShift, non-RPM packages, and third-party applications.</p><p><strong>• Package Deduplication (Counts May Decrease)</strong>: Improved deduplication logic for language-specific packages (e.g., Python, Amazon Linux, RHEL) managed by the OS package manager against the underlying OS advisory to eliminate redundant alerts.</p><p><strong>• Severity Scoring & Metadata (Severities May Shift)</strong>: Enriched our vulnerability metadata with merged data from National Vulnerability Database (NVD) and GitHub Advisory Database (GHSA):<br>• Previously unscored vulnerabilities now have assigned scores.<br>• Standardized legacy labels (e.g., unimportant changes to info).<br>• Corrected vendor severity ratings for Oracle, Debian, Ubuntu, RHEL, AlmaLinux, SUSE, and Windows (some severity ratings will rightfully shift).<br>• Added contextual metadata for Go, RedHat, and Busybox advisories.</p><p><strong>Impact</strong>: Changes in vulnerability counts and severity distributions, which may in turn impact SLA’s, alerting and ticketing, dashboards or CI/CD quality gates which rely on vulnerability counts or severity thresholds.</p> |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-6.x-rn/release-information/features-introduced-in-2026/november-2026/changed-features.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.